Your Incident Response Plan May Have a Decision Problem
Your security team may detect an attack in seconds, but unclear decision authority can delay containment for hours. David Harris examines why incident response planning must address authorization, escalation, human oversight, bounded automation, and verification—and the five questions CEOs should ask before the next incident.
More AI Will Not Fix a Poorly Designed SOC
Adding AI does not automatically fix fragmented security operations. Tim Shelton examines how disconnected tools, unreliable context, unclear response authority, and inefficient workflows can limit the value of SOC automation—and why organizations must redesign their decision processes before scaling AI.
AI Authority Is Becoming a Business Control
As AI agents move from recommendations to actions, businesses must govern more than access and permissions. David Harris explains why delegated authority is becoming an enterprise control, how bounded autonomy should work, and what CEOs must require for enforcement, accountability, revocation, and business-risk oversight.
AI Agent Security Testing: What Happens When Agents Get Creative?
AI agents can combine legitimate capabilities in ways their designers never anticipated. Tim Shelton applies lessons from exploit research to AI agent security testing, examining unexpected workflows, combined permissions, trust boundaries, enforceable authorization, and why testing must establish what an agent can actually accomplish—not just what it was intended to do.
What Exploit Research Taught Me About AI Agent Security
Exploit research teaches security professionals to examine what systems can actually do—not merely what designers intended. Tim Shelton applies that principle to AI agent architecture, exploring combined permissions, runtime enforcement, human-controlled autonomy, progressive authority, and the need to verify operational outcomes.
Incident Response Metrics: Measure Time to Verified Outcome
Alert counts and response times don't tell executives whether a cyber threat was actually contained. David Harris examines the incident response lifecycle, including evidence gathering, decision latency, authorized action, and time to verified containment—and explains what CEOs should measure after a significant security incident.
Cybersecurity Board Reporting: Measure Risk Reduction, Not Alerts
A cybersecurity dashboard can show improving operational metrics while the business remains exposed. David Harris examines what boards should measure instead: material risk reduction, exposure affecting critical operations, verified containment, residual risk, and executive accountability.
Escalating CyberThreats Associated With Russia/Ukraine Confrontation
HAWK's automated threat intel platform ensures the latest known threats can be detected. HAWK's existing analytic rules cover all of the threats currently outlined in the US-CERT Alert AA2-011A
Detecting Windows PrinterNightmare Bug Exploit Code
Jason Wheeler, VP Customer Service HAWK.io, discusses his approach to creating the detection rules for the PrinterNightmare eploit. He will also discuss what to look for in the raw Windows event logs and the time saving benefits of HAWK vTTAC™ data enrichment for automatically capturing critical information needed for efficient digital forensics and incident response (DFIR).
Unicode Reflection - Event Null Byte Injection
HAWK experts look at “Log Jam”, the latest Unicode data reflection exploit. How they detected it’s presence and how HAWK.io MDR can complement existing EDR deployments by providing missing telemetry data critical to efficient and effective SOAR efforts.
Solving Rogue Device Detection and User Permission Investigation with Real-Time Data Enrichment and Analysis
Tim Shelton, CTO/Founder of HAWK Network Defense, aka redsand in the hacker community will explore the core components necessary to drive efficiency and effectiveness of Security Orchestration and Response (SOAR). He will also discuss the requirements to build organizational trust in the processes from incident creation, validation, prioritization, and finally to response. Because the holy grail of SOAR is automated SOAR. There are many hurdles for people, processes, and technology must clear to win the race.